Search the archive

WORLDCOIN DATA COLLECTION HALTED

Portugal's data protection authority has ordered Worldcoin to stop collecting biometric data, citing serious risks to citizens' rights.

HOW A PRIVACY PROTOCOL CAN'T WORK WITHOUT NATIVE AA

This thread covers how privacy protocols require native account abstraction (AA) to function effectively, using UTXOs and decryption keys to maintain privacy.

AMAZON’S PALM-SCANNING SERVICE NOW LETS YOU SIGN UP FROM YOUR PHONE

Amazon has introduced a new iOS and Android app that allows users to register for its palm recognition service, Amazon One, by uploading a photo of their palm, eliminating the need to enroll at physical locations. The technology encrypts and securely stores palm prints in the cloud. The added security layers may only alleviate privacy concerns for some users.

FORMER YAHOO CEO MARISSA MAYER’S NEW PHOTO-SHARING APP HAS A DESIGN FROM THE STONE AGE

A new app from Marissa Mayer, former Yahoo CEO, aims to make it easy for users to create and share photos of trips, parties, or hangouts with friends. However, its (lack of) design, looking like something from the early 2010s, is very clunky-looking and not at all like the apps we’re used to today.

AMAZON FINED IN POLAND FOR DARK PATTERN DESIGN TRICKS

Poland's consumer and competition watchdog has fined Amazon nearly $8 million for deceptive practices that included misleading consumers about contract conclusions and employing 'dark design patterns' to create urgency in purchases. The e-commerce giant, accused of not honoring stated delivery dates and availability, plans to appeal the sanction.

LISTEN HEAR: HOW DESIGNERS CREATE SOUNDS FOR PIXEL

Sound design can alleviate visual overload and communicate more information to users. The Google Pixel sound design team believes sound can be used to convey emotion and create urgency. The team aims to create a sonic experience that is playful, human, and simple.

DEFINING EXPERIENCE QUALITY IN LARGE LANGUAGE MODELS

Adobe is adding two new Generative AI features to Acrobat and Acrobat Reader to unlock information in PDFs. “AI Assistant” answers questions about documents to help people understand information, get insights quickly, and instantly generate content for deliverables. It is supported by “Generative summary,” an AI Assistant capability that builds one-click summaries of documents' key sections.

A DESIGN RESET - PART I

Design debt accumulates incrementally but should be addressed comprehensively, contrary to the conventional engineering practice of avoiding complete code rewrites. Unlike engineering changes, which can go unnoticed, the product experience is visual and holistic, necessitating a different approach.

IOS APP ICON TEMPLATE (FIGMA FILE)

App icon template for iOS 17 that allows designers to see their apps in context. The mockup comes in light and dark modes.

AI-GENERATED BACKGROUNDS

Browse a collection of breathtaking AI-generated backgrounds, download them in 6K, and view their corresponding Midjourney prompts.

BUILD FORMS FASTER

Weavely generates pixel-perfect web forms out of your Figma designs.

GETTING OUT OF MEETINGS AND INTO FOCUSED WORK

It's common for creatives to spend their entire day in meetings with little time for creativity or thought. Don't feel bad about declining meetings - just remember they do not work. Consider their value to customers. Schedule meetings for your goals and build your social connections beyond meetings.

ON DEDICATION AND LOVE FOR THE INVISIBLE WORK

Craft and strategic thinking are often seen as opposites in the industry, but you can be strategic and still deliver well-crafted, polished, and thoughtful work. Craft usually best suits focused groups with the same vision who care about what's being made. However, if viewed as a critical value by the company's executives, craft can scale and be integrated into team structure and processes.

ARE YOU STOPPING ONE STEP SHORT OF DRIVING CHANGE THROUGH USER INSIGHTS?

Presenting information involves sharing raw data or fundamental analysis while communicating insights, providing a more profound understanding by interpreting the data, offering context, and suggesting actionable next steps. This helps persuade teams to make meaningful changes and how designers should use data to design meaningful changes and stop constantly “putting out fires.”

THE CASE FOR DESIGN ENGINEERS, PT. III

Design engineers are required to design and build something great.

NEW IKEA CAMPAIGN FINDS AN ORIGINAL WAY TO TALK ABOUT ITS LOW PRICES

A new series of commercials created for the United Arab Emirates, entitled 'Don't Worry, You Can Afford It', puts pets and the havoc they create squarely in the spotlight, showing various IKEA products, including planters, mugs, cushions, and vases, being knocked over by adorable cats and dogs.

AN OPEN SOURCE LIBRARY OF WEB COMPONENTS

You can drop Web Awesome components anywhere on the web and they'll work - no JavaScript framework is necessary.

AMAZON INVESTS $4B IN ANTHROPIC

Amazon has completed a $4 billion investment in AI research company Anthropic, which is using Amazon Web Services (AWS) as its primary cloud provider for critical workloads. This investment is part of a strategic collaboration that will provide AWS customers with access to advanced generative AI technologies, including Anthropic's Claude AI models, through Amazon Bedrock, a service offering managed foundation models and tools for building AI applications.

10 CHARTS THAT CAPTURE HOW THE WORLD IS CHANGING

HOW BREX WENT FROM ZERO TO A $12.3B COMPANY

Brex, a financial services company founded by Henrique Dubugras and Pedro Franceschi, rapidly grew to a valuation of $12.3 billion in 6 years by focusing on providing corporate credit cards to startups, optimizing for user acquisition and retention, and expanding its product suite to include cash management, expense tracking, and venture debt. The company successfully navigated challenges by pivoting from serving SMBs to doubling down on startups and venture-backed businesses. It played a crucial role in supporting the startup ecosystem during the Silicon Valley Bank crisis.

WHAT TO EXPECT WITH DILUTION

This article discusses the dilution founders face when raising capital through various funding rounds, using data from over 43,000 US companies on the Carta platform. The standard advice of selling 20% in early-stage rounds remains. Founders have been selling less of their companies over the past four years. Challenges like bridge financings and investor-friendly deal terms can significantly increase dilution.

BUILDING COMPANIES ON CAMPUS

This article shares the unique challenges and opportunities faced by student founders, emphasizing the importance of choosing the right co-founder based on trust, solving problems they are passionate about, and leveraging their position as students to access resources and networks.

DON’T TAKE FREE CASH FLOW AT FACE VALUE

It is important to scrutinize the underlying factors of free cash flow (FCF) margins in software companies. Founders should be wary of taking headline FCF numbers at face value due to the potential for non-structural factors to temporarily inflate these figures. A deeper analysis of FCF components, such as stock-based compensation and changes in net working capital, can help you understand a company's true profitability and the sustainability of its FCF improvements.

JULIUS

Analyze your data with computational AI.

YOUTUBE INVESTMENT MEMO (DOCUMENT)

Sequoia’s investment memo on YouTube from 2005.

STORYTALE 3

7,200+ graphic assets for your design projects.

HOW TO PLAN FOR SUCCESS (37 MINUTE AUDIO)

Mohit Aron, a successful two-time founder, shares his essential blueprints and checklists for startup success, emphasizing the importance of a solid foundation, a product that addresses customer pain points with a significant market, and a clear execution plan. He also outlines a hiring strategy for non-technical roles that involves a thorough three-phase checklist to ensure candidates align with the company's culture and possess a proven track record.

THE AI SDR ERA

11x.ai, a London-based AI startup, achieved remarkable growth from $0 to $2 million ARR in just six months by leveraging its AI-powered digital SDR, Alice, to automate outbound prospecting and generate significant sales leads. The company's success is attributed to its innovative approach of targeting hiring budgets with a hard ROI value proposition, embracing high velocity in operations, and focusing on a technical edge to deliver more value than traditional methods.

FIND THE SAVAGES: UNCOVERING HIDDEN EARLY-CAREER TALENT

This article discusses the evolving landscape of college graduate recruitment, highlighting a shift from traditional "target" schools to a broader, more inclusive approach that values diverse backgrounds and experiences. It suggests hiring from "non-target" schools, where students demonstrate greater drive, humility, and willingness to learn. Companies should expand their recruitment strategies to uncover hidden talent.

SELLING AI: CATEGORY CREATION OF A DIFFERENT FLAVOR

This article discusses the shift in software sales towards AI agents, emphasizing the need for sellers and startups to reimagine their roles and create new categories.

THE #1 THING TO DO WHEN TIMES ARE HARDER

Businesses should focus on taking it a quarter at a time - setting and surpassing micro-milestones fosters growth and resilience.

THE CONFIDENCE GAME

Confidence, or the lack thereof, can significantly impact one's ability to make decisions effectively and efficiently.

PYPI HALTED NEW USERS AND PROJECTS WHILE IT FENDED OFF SUPPLY-CHAIN ATTACK

PyPI, the main Python Package Index repository, temporarily halted new project creation and user registration due to a continuous attack of malicious package uploads designed to infect devices through typosquatting techniques. After a 10-hour suspension, PyPI restored normal operations as it had addressed the security concerns.

NVIDIA'S NEW CHATGPT-LIKE AI CHATBOT FALLS VICTIM TO HIGH-SEVERITY SECURITY VULNERABILITIES - URGENT CHATRTX PATCH ISSUED

Nvidia's ChatRTX AI chatbot was found to have severe security vulnerabilities in versions 0.2 and prior, including cross-site scripting and improper privilege management attacks. Nvidia has addressed these issues in the latest iteration of ChatRTX 0.2.

LINUX VERSION OF DINODASRAT SPOTTED IN CYBERATTACKS

The multiplatform backdoor, DinodasRAT, has been spotted infecting Linux machines in several attacks in China, Turkey, Taiwan, and Uzbekistan. The malware, also known as XDealer, is an infostealer and backdoor. It establishes persistence by using SystemV or SystemD startup scripts.

ANALYSIS OF THE MOBOX SECURITY BREACH

The MOBOX decentralized lending protocol was attacked on March 14, leading to losses of $750,000. The attack was possible because of a vulnerability in the logic of the contract’s borrow() function that allowed the attacker to burn the pool’s currency which drove up the price while the attacker claimed referral rewards to use for more borrowing. The team recommends that similar lending protocols implement lock-up period restrictions to prevent these attacks.

DISSECTING A COMPLEX VULNERABILITY AND ACHIEVING ARBITRARY CODE EXECUTION IN ICHITARO WORD

This research document by Cisco Talos details a complex vulnerability in Ichitaro Word that leads to arbitrary code execution. The exploit achieves a frame pointer overwrite by exploiting an out-of-bounds index, enabling the construction of powerful exploitation primitives for full code execution. This detailed document provides a good walkthrough on how to approach similar reverse engineering problems to find vulnerabilities in software.

HOW APPLE MITIGATES VULNERABILITIES IN INSTALLER SCRIPTS

Installer Scripts are valuable targets for attackers as they give processes and their children access to areas in the system that are protected by System Integrity Protection. This article details how vulnerabilities have bypassed these protections in the past. It provides an in-depth look at PackageKit, which is designed to eliminate this full class of vulnerabilities.

FBI-TOOLS

A list of OSINT Tools for gathering information and actions forensics.

ARSENAL

Tools and scripts for personal use cases and bug bounties

DROZER

After 7 years, a new version of Drozer has been released. Drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Android Runtime, other apps' IPC endpoints, and the underlying OS.

US OFFERS $10M TO HELP CATCH CHANGE HEALTHCARE HACKERS

The U.S. government will provide a $10 million reward for information on the ALPHV/BlackCat cybercrime gang's leadership after an affiliate claimed responsibility for the massive ransomware attack on a U.S. health tech giant last month.

DIVING DEEPER INTO AI PACKAGE HALLUCINATIONS

AI Package Hallucination exploits LLMs like ChatGPT and Gemini to spread non-existent, potentially malicious packages through recommendations. Extensive testing on the GPT-3.5 Turbo model with 457 questions across 40 subjects in two programming languages revealed a concerning 30% hallucination rate.

A LOOK AT SOFTWARE COMPOSITION ANALYSIS

Doyensec published a whitepaper on the results of testing Snyk, Dependabot, and Semgrep for SCA. The goal of the test was to find which tool had the highest true positive rate with the lowest false positive rate, while ignoring false negative rate. The test found that Dependabot had the highest true positive rate but also the highest false positive rate while Semgrep had the second highest true positive rate and the lowest false positive rate.

NAVIGATING CYBER 2024 REPORT

This report highlights the escalating sophistication of adversarial tactics leveraged by threat actors, including social engineering, SEO poisoning, malvertising, and QR code phishing, as well as their exploitation of generative AI for scaled attacks.

VULTR’S NEW TERMS OF SERVICE CLAIMS COMMERCIAL RIGHTS (MASTODON THREAD)

Vultr, a cloud provider, recently updated its Terms of Service to include a clause granting perpetual commercial rights over all hosted content.

LIFE AFTER DEATH? IO CAMPAIGNS LINKED TO NOTORIOUS RUSSIAN BUSINESSMAN PRIGOZHIN PERSIST AFTER HIS POLITICAL DOWNFALL AND DEATH

Prigozhin's influence on information operations campaigns persists despite his undoing - the infrastructure of these campaigns remains active, posing a potential threat to global security.

LINKEDIN TARGETS USERS CAUGHT BETWEEN TIKTOK AND WHAT USED TO BE TWITTER

By introducing games and short-form content, LinkedIn seems to be strategically targeting users who find themselves lost between TikTok and the transformed Twitter. It is trying to position itself as a unique blend of professional networking and engaging content for a broader audience.